Analytics BIOC High
✕

A Successful login from TOR

A successful login from a TOR exit node.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Initial Access (TA0001) Command and Control (TA0011)
ATT&CK techniques: Proxy: Multi-hop Proxy (T1090.003) Valid Accounts (T1078)
Attacker's goals:

Gain initial access to the organization while anonymizing the source of the activity.

Investigative actions:

Block all web traffic to and from public Tor entry and exit nodes. Search for additional logins from the same user around the alert timestamp.

Test period:
N/A (single event)
Deduplication:
1 Hour